IPv6 Operator Development ProgramThis material is translated based on the“iDC/ISP/CATV
iDC/ISP/CATV Servers Hands‐On Seminar
Seminar”
by Koichi Kunitake, BeaconNC Inc.,on December 17‐18, 2009,
organized by
Task Force for IPv4 Exhaustion, Japanh //http://www.kokatsu.jp/
k k
j /
1
© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6 Operator Development Program

iDC/ISP/CATV Servers
BeaconNC Inc. Data Center Dept.
Koichi Kunitake© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6 Operator Development Program

Today’s topic• Purpose– Acquire knowledge for server operation in
IPv6 environment on Linux OS

Note: We will use CentOS (RedHat stream) and GNU/Debianfor the distribution dependent issues© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

3

IPv6 Operator Development Program

Overview• IPv6 main feature• Basic knowledge for using IPv6 on Linux– IPv6 address text representation– IPv6 address type
– ULA
– Header information– Dual Stack– DNS IPv6 support© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

4

IPv6 Operator Development Program• IPv6 main feature• Basic knowledge for utilizing IPv6 on
Linux– IPv6 address text representation– IPv6 address typeyp
– ULA
– Header information– Dual Stack– DNS IPv6 support© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

5

IPv6 Operator Development Program

IPv6 main feature• Huge address space (from 32bits to
128bits))• Address auto configuration– AimsAitot lowerltheth administrationd i i t ti costt• IPsec standard implementationp• MobileIP– More sophisticated architecture than IPv4
MobileIP
Others: Simple header architecturearchitecture, disable fragmentation at theintermediate routers and introduction of extension headers© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

6

IPv6 Operator Development Program

IPv6 huge address space• Suppose IPv4 address space is 1, then IPv6
address space is…

79228162514264337593543950336
You can assign the IPv6 addresses, as many as current
IPv4 addresses, to each person on the earth, andthere are still good quantity of remained addresses.
However, the netmask architecture is different in
However
IPv4/IPv6, and cannot compare the address
space that easy like above example© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

7

IPv6 Operator Development Program

IPv6 huge address space (cont.)• It is no use to compare the numbers of
IPv4 and IPv6 addresses, but IPv6
g enoughgaddress is huge
• Usable segments (*)– IPv4
IP 4 : 1073741824– IPv6 : 18446744073709551616(*) Utilize /30 in IPv4 and /64 in IPv6 for calculation. This is just to get the idea as all theaddress space cannot be used as global addresses© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

8

IPv6 Operator Development Program

Address auto configuration• AddressAdd
auto
t configurationfi
ti ffunction
ti iisdefined as standard function in IPv6 tosupportt immenseinumberb off devices
d iconnected to the network– You can also use DHCPv6
RA
RS

RS

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

9

IPv6 Operator Development Program

Router Solicitation/Router Advertisement
•
•
•
•
•
•
•

RS’s destination address is FF02::2,, and the Hop
p Limit is 255
RA’s destination address is FF02::1 or the RS’s source address, and the Hop Limit is255
Current Hop Limit field in RA sets the node’s hop limit
If M‐flag is 0, then stateless address will be automatically configured, and if it is 1,
address will be assigned using DHCPv6
If O‐flag is 1, information other than the address will be delivered by DHCPv6
Only the default router sets the Router Lifetime to more than 1 (less than 65535)
DRP (Default Router Preference: RFC4191) defines how to inform default router’s
priority– High(01),g ( ), Medium(00),( ), Low(11)( )– Both routers and nodes have to support the function to enable this function
1

FE80::1

Router Solicitation
Src=FE80::1
D t FF02 2
Dst=FF02::2
2

FE80::2

Router Advertisement
Src=FE80::2
Dst=FF02::1 (or FE80::1)
Data=Subnet prefix, lifetime, current hop limit
Flag (management, other) , preference© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

10

IPv6 Operator Development Program

IPv6 address state and lifetime•

tentative address– Address that will not be assigned to interfaces. Used for ND messages only. Confirms
the uniqueness of addresses using DAD.

•

preferredfd address
dd– Interface’s address. Unique and communication‐able address.

•

deprecated address– Valid address,
address but initiating communications with this address is not recommended•

valid address– Preferred addresses and deprecated addresses•

Invalid address– When the valid address’s timeout occurs, it is changed to invalid address
Address valid lifetime and status change
Valid addressI
lid address
dd
preferred address deprecated address Invalid0

t1

t1：preferred lifetime
t2：valid lifetimet2© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

11

IPv6 Operator Development Program

Stateless auto‐configuration flow
fe80::211:22ff:fe33:4455
2001:db8::211:22ff:fe33:4455
MAC:00:11:22:33:44:55

fe80::211:22ff:fe66:7788
2001:db8::211:22ff:fe66:7788
MAC:00:11:22:66:77:88

1 Neighbor Solicitation (NS)When there are no neighboradvertisement, the target
address can be utilized<Duplicated Address
Detection>

Solicited-Node Multicast
1
Link local addressconfirmation

Src MAC 00:11:22:33:44:55
Dst MAC 33:33:FF:33:44:55
Src IPv6 :: (undefined address)
Dst IPv6

ff02::1:ff33:4455

ICMPv6 Type 135
Target fe80::211:22ff:fe33:4455
Src MAC 00:11:22:33:44:55

2 Router Solicitation (RS)All router Multicast
Send to (ff02::2)

Dst MAC 33:33:00:00:00:02
Src IPv6 fe80::211:22ff:fe33:4455
Dst IPv6

ff02::2

ICMPv6 Type 133

2

3

4
Global addressconfirmation

3 Router Advertisement
All node multicast
Send to (ff02::1)
Generate global address
utilizing the acquired prefix

Src MAC 00:11:22:66:77:88
Dst MAC 33:33:00:00:00:01
Src IPv6 fe80::211:22ff:fe66:7788
Dst IPv6

ff02::1

ICMPv6 Type 134
Prefix 2001:db8::

4 Neighbor Solicitation
When there are no
Src MAC 00:11:22:33:44:55
neighbor advertisement,
the target address can be
Dst MAC 33:33:FF:33:44:55
utilized.
Src IPv6 :: (undefined address)
When there are replies,
Dst IPv6 ff02::1:ff33:4455
have to rere-constructconstruct theaddress
ICMPv6 Type 135<Duplicated Address Detection> Target 2001:db8::211:22ff:fe33:4455© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

12

IPv6 Operator Development Program

Link layer address resolution flow
fe80::211:22ff:fe33:4455
2001:db8::211:22ff:fe33:4455
MAC:00:11:22:33:44:55

fe80::211:22ff:fe66:7788
2001:db8::211:22ff:fe66:7788
MAC:00:11:22:66:77:88

1

1 Neighbor Solicitation (NS)Search communication
partner’s MAC address
When there are no neighboradvertisement, the node is notonlinkSrc MAC 00:11:22:33:44:55

Neighbor Advertisement
Node with the target address
repliedreplied.
Any node can reply

Src MAC 00:11:22:66:77:88

2
2

MAC addressacquired

Dst MAC 33:33:FF:66:77:88
Src IPv6 fe80::211:22ff:fe33:4455
Dst IPv6 ff02::1:ff66:7788
ICMPv6ICMP
6 TypeT
135
Target 2001:db8::211:22ff:fe66:7788

Dst MAC 00:11:22:33:44:55
Src IPv6 fe80::211:22ff:fe66:7788
Dst IPv6 fe80::211:22ff:fe33:4455

3
3Start communication

ICMPv6 Type 136
Target 2001:db8::211:22ff:fe66:7788
Target MAC 00:11:22:66:77:88© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

13

IPv6 Operator Development Program

IPsec: standard function• Guarantee secure communication at the
IP layer– No need to remodel the applications
The Internet© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

14

IPv6 Operator Development Program

MobileIP• Compatibility
C
ibili withi h ubiquitousbi i– Same IP address can be utilized anywherey– More realistic system than IPv4 MobileIP
The Internet

Same IP address after location change© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

15

IPv6 Operator Development Program

Basic knowledge for utilizing IPv6 on Linux© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6 Operator Development Program• IPv6 main feature• Basic knowledge for utilizing IPv6 on
Linux– IPv6 address text representation– IPv6 address typeyp
– ULA
– Header information– Dual Stack– DNS IPv6 support© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

17

IPv6 Operator Development Program

IPv6 address text representation• IPv4 address text representationp– Example) 192.0.2.1
Decimal number notation, utilize “.” as delimiter• IPv6 address text representationp– Example) fe80:0000:0000:0000:02d0:b7ff:fea0:beea
Hex number notation, utilize “:”: as delimiter© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

18

IPv6 Operator Development Program

Abbreviation in IPv6
fe80:0000:0000:0000:02d0:b7ff:fea0:beea• Leading zero in each part can be abbreviatedfe80:0000:0000:0000:2d0:b7ff:fea0:beea• Compress the zeros with “::” Can be done only
once for each address
fe80::02d0:b7ff:fea0:beea
Therefore, the notation becomes fe80::2d0:b7ff:fea9:beea© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

19

IPv6 Operator Development Program

How about the following case?
• 2001:0db8:0000:0000:fff0:0000:0000:000f
2001:db8::fff0:0:0:f
2001
db8 fff0 0 0 f
or
2001:db8:0:0:fff0::fNote) Cannot be written as 2001:db8::fff0::f© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

20

IPv6 Operator Development Program• IPv6 main feature• Basic knowledge for utilizing IPv6 on
Linux– IPv6 address text representation– IPv6 address typeyp
– ULA
– Header information– Dual Stack– DNS IPv6 support© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

21

IPv6 Operator Development Program

IPv6 address typeIPv6 address classification (Example)• Behavior• Scope• Special purpose address© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

22

IPv6 Operator Development Program

Classification using packet behavior• Unicast Address• Multicast Address• AnycastAt Address
Add© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

23

IPv6 Operator Development Program

Unicast Address• The address for each network interface• Used for one to one communication(Generally this address is used)(Generally,© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

24

Unicast Address25

IPv6 Operator Development Program

Multicast Address• Specifies
p
ag
group
p address– When a packet is transmitted to a multicast
address, all the interface that is in thespecified multicast group will receive thepacket.
– IPv6 has no broadcast address like IPv4, but
IPv6 uses multicast for same purpose
purpose.

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

26

IPv6 Operator Development Program

Multicast Address
128bits
11111111

Flag

Scope

Group ID

8

4

4

112

Bits

T=0 permanent multicast address
T=1 temporary multicast address

M li
Multicastscope: 4-bit
4 bit multicast
lti
t scope value
l iis used
d tto lilimit
it th
the scope off th
the multicast
lti
t group.
0 reserved
1 node-local scope
2 link-local
link local scope
3 (unassigned)
4 (unassigned)
5 site-local scope
6 (unassigned)
7 (unassigned)
8 organization-local scope
9 (unassigned)
A (unassigned)
B (unassigned)
C (unassigned)
D (unassigned)
E global scope
F reserved© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

27

Multicast Address28

IPv6 Operator Development Program

Anycast Address• An address that specifies
p
ag
group
p address(similar to multicast address)– The difference with the Multicast Address isthat the packet will not be send to all theinterfaces belonging to the group
group. Whendelivered to one interface, the packet will not
be sent to other interfaces
interfaces.

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

29

Anycast Address

X

30

IPv6 Operator Development Program

Classification by scope• Global Address• Site-local Address (obsolete)– Changed to Unique Local Address (ULA)• Link-Local Address© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

31

IPv6 Operator Development Program

Global Address• Same with IPv4 Global Address• Worldly unique identifier

128bits

Subnet prefix

Interface ID

n

128-n

Bits

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

32

IPv6 Operator Development ProgramSite-Local Address (Obsolete)• Private Address in IPv4
• Packets from this address will not transmitted to otherorganizations• Got obsolete as there are many problems (taken overbyy Uniqueq Local IPv6 Unicast Address))
128bits

1111111011

0Subnet ID

Interface ID

10

38

16

64

Bits

Unique Local IPv6 Unicast(ULA) is different than Site-Local
Site Local Address
Address, and its address
can be used like Private Address. The cases are VERY RARE that ULA addresses are
duplicated with other organizations© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

33

IPv6 Operator Development Program

Link-Local Address• Address that is valid only within the node’s
directlyd
ect y coconnected
ected link
• Automatically generated even when there are norouters that sends RA in the neighboring link
• Well-known Link-Local Address• ff02::1 (This is also Multicast Address)– All the nodes in one link are in this address group• Have to be utilized with scopep ID– Example: “ping6 –I eth0 ff03::1”, “ssh fe80::dead:beaf%eth0”© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

34

IPv6 Operator Development Program

Each address scope
Global Address
Unique Local
Unique Local

Unique Local

Unique Local

Link Local© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

35

IPv6 Operator Development Program

Special Purpose Address• UnspecifiedpAddress• Loopback address• IPv4-compatible
IP 4tibl address
dd• IPv4-mapped
pp address© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

36

IPv6 Operator Development Program

Unspecified Address• Indicates the absence of an address• System initializing host with no IP
address sometimes uses this address
as source address
0000:0000:0000:0000:0000:0000:0000:0000::© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

37

IPv6 Operator Development Program

Loopback address• Used by a node sending an IPv6 packet
to itself.
itself Same with IPv4
IPv4’ss 127
127.0.0.1
001

0000:0000:0000:0000:0000:0000:0000:0001::1© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

38

IPv6 Operator Development Program

IPv4-compatible Address (obsolete)• Utilized for communications among IPv6 nodes
connected only to IPv4 network• IPv4 address is described in binary digit notation foreasy understanding
Example) “192.168.0.1” => “::192.168.0.1”
128bits

0000…………………………………0000

80

0000

IPv4 address

16

32

Bits

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

39

IPv6 Operator Development Program

IPv4-mapped Address• Utilized
ili d forf communications
i ibetweenb
IPv66
nodes with nodes supporting only IPv4 address• IPv4
IP 4 addressdd
iis ddescribedib d ini binarybi
digit
di i notationifor easy understanding
Example: “192.168.0.1” => “::ffff:192.168.0.1”
128bits

0000
0000…………………………………0000
0000

80

FFFF

IPv4Address

16

32

Bits

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

40

IPv6 Operator Development Program• IPv6 main feature• Basic knowledge for utilizing IPv6 on
Linux– IPv6 address text representation– IPv6 address typeyp
– ULA
– Header information– Dual Stack– DNS IPv6 support© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

41

IPv6 Operator Development Program

Unique Local IPv6 Unicast Addresses• Globally unique prefix• Can be filtered easily by site boundaries(e.g.
g• Can be utilized without external link (econnection to ISP)
• Even when the routes are leaked to outside
network, they will not be duplicated with otheraddresses• Applications can utilize this address as same as
globall b l addresses
dd© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

42

IPv6 Operator Development Program

Format7
Prefix41
Global ID

16
Subnet ID

64
Interface ID• Prefix
Prefi: ExampleEl (FC00(FC00::/7)/7)• Global ID :Global Identifier• Subnet ID :ID for subnet within a site
• Interface
I t f
ID

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

43

IPv6 Operator Development Program

Global ID• Utilizes MD5 based pseudo-randompalgorithm• Assumes 2 prefix– FC00::/8 Centrally assigned– FD00::/8 Locally assigned• Centrally assigned• Locally assigned© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

44

IPv6 Operator Development Program

Centrally assigned• Address allocation organizationgassures
there will be no address conflict• Can be utilized permanently without
periodic payment• However, service charge of 10 euro((cannot be refund)) is requiredq
for eachallocation……

are discussed (but not finalized yet)
© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

45

IPv6 Operator Development Program

Locally assigned• Global ID is g
generated usingg Pseudorandom algorithm• No need to register to the address
allocating organizations– How to generate ULA by yourself?
• Utilize ULA Generator
http://www.kame.net/~suz/gen-ula.html© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

46

IPv6 Operator Development Program• IPv6 main feature• Basic knowledge for utilizing IPv6 on Linux– IPv6 address text representation– IPv6 address type
– ULA
– Header information– Dual Stack– DNS IPv6 support© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

47

IPv6 Operator Development Program

Header Information• Simplifiedpheader format– 40 byte fixed length (Utilizes extension
headers)• Stopped utilizing check sum– UDP check sum is indispensable© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

48

IPv6 Operator Development Program

IPv4 header
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Bits
Version

IHL

Total Length

TOS

Flag

Identifier

TTL

ProtocolFragment Offset

Header Check Sum

Source Address

Destination Address

Option (+ Padding)© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

49

IPv6 Operator Development Program

IPv6 header
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Bits
VersionFlow Label

Traffic Class

Payload Length

Next Header

Hop Limit

Source Address

Destination Address• Simplified compared to IPv4
• Option headers became obsolete, and extension headers were implemented instead© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

50

IPv6 Operator Development Program

Extension header• Hop-by-Hop
H b H O
Optionsi
H
Headerd– Includes information that have to be referred by every node on theintermediate route.

• Destination Options Header– Specify the recompiling order at the destination address node

• Routing Header– Specifies at least one or more intermediate nodes• Fragmentg
Header– Specifies the packet is fragmented. Unlike IPv4, the packets will not
be fragmented at the intermediate routers.

• Authentication Header• Encapsulating Security Payload Header– These 2 headers are used by IPsec to enable secure communication
att IP levelll© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

51

IPv6 Operator Development Program

Beaded extension headers
IPv6

TCP

headerheader

Application Data

Next header
= TCP

IPv6
headerNext header= Routing

IPv6
headerNext header= RoutingRouting
headerTCP

Application Data

headerNext header+TCP

Routing
headerFragment
headerNext header= Fragment

TCP
header

Application Data
(Fragment)

Next header= TCP© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

52

IPv6 Operator Development Program

Extension header detail• Basic Typeyp
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Bits
Option Type

Opt Data Len

Option Data

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

53

IPv6 Operator Development Program

Hop-by-Hop options header
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Bits
Hdr Ext Len

Options

・・・

・・・

Next header• The options will be processed at all intermediate routers© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

54

IPv6 Operator Development Program

Destination Headers Option
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Bits
Next header

Hdr Ext Len

・・・

・・・

Option• The
Th options
ti
will
ill b
be processedd onlyl att ththe ddestination
ti ti noded

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

55

IPv6 Operator Development Program

Routing Header
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Bits
Next Header

Routing TypeHdr Ext Len

Segment Left

Reserved

Address [1][ ]Address[2]

・・・

・・・

・・・

Address [n]• A option that specifies at least one or more intermediate nodes© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

56

IPv6 Operator Development Program

Fragment Header
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Bits
Next Header

Reserved

Fragment Off Set

Res M

Identification© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

57

IPv6 Operator Development Program

Authentication Header
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Bits
N t hheader
Next
d numberb

P l d llength
PayloadthR
ReserveddSecurity Parameter Index (SPI)
Sequence Number

・・・

・・・

Authentication Data

• Option to authenticate the communication counterpart (Used in IPsec)© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

58

Encapsulating Security Payload
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Bits
S
Security
Parameter Index (S(SPI))

Sequence Number

・・・

・・・

ペイロードデータ（バリエイブル）
Payload Data

Padding（0-255octets）
Pad length

Next Header Number

・・・

・・・

Authentication Data

• An option used to communicate with encrypted data (Used in IPsec)
59

IPv6 Operator Development Program

Recommended order of extension headers
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Bits
Traffic ClassPay load Length

Flow Label
Next Header
Source Address
Destination Address

Hop Limit

IPv6 header

VersionHop-by-Hop Options
Routing Header

Destination Options (with Routing Option)
Authentication Header
Encapsulation Security Payload Header

Extension he
E
eader

F
FragmenttH
HeaderdDestination Options
Upper Layer Headers© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

60

IPv6 Operator Development Program• IPv6 main feature• Basic knowledge for utilizing IPv6 on
Linux– IPv6 address text representation– IPv6 address typeyp
– ULA
– Header information– Dual Stack– DNS IPv6 support© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

61

IPv6 Operator Development Program

What is Dual Stack
Nodes have IPv6/IPv4 addresses, and able
to communicate in both addresses
www.example.com.
mail example com
mail.example.com.

IN
IN
IN

A
192.0.2.1
A
192 0 2 1
192.0.2.1
AAAA 2001:db8::1• What is AAAA?
– One of DNS records,, which specifiespIPv6
addresses© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

62

IPv6 Operator Development Program

Establishing TCP connections
1. Inquire the addresses
1
2. AAAA RR or A RR will be returned
3. Co
3Connectec throughoug IPv6
6
4. Fallback to IPv4 when IPv6 connection cannot be established
The Internet①②

IP 6 node
IPv6
d

③
④

A site with AAAA/A© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

63

IPv6 Operator Development Program

Confirm the behavior from the program#include <stdio.h>#i l d <#include<sys/types.h>/th>#include <sys/socket.h>#include <netdb.h>• "IPv6 support" isequal to "addressfamilyp
independence"

int sock,err;
struct addrinfo hints, *res0, *res;memset(&hints, 0, sizeof(hints));
hints.ai_family = PF_UNSPEC;hints.ai_socktype = SOCK_STREAM;/* Acquire AAAA and A record by getaddrinfo */err = getaddrinfo("www.linux-ipv6.org",
getaddrinfo("www linux ipv6 org" "http""http", &hints&hints, &res0);

if (err) {fprintf(stderr, "error : %s", gai_strerror(err));
freeaddrinfo(res0);
exit(1);}/* Continue until the connection is established using the result ofgetaddrinfo*/for (res = res0; res; res = res->ai_next) {sock = socket (res->ai_family, res->ai_socktype, res->ai_protocol);if (sock < 0)continue;if (connect(sock, res->ai_addr, res->ai_addrlen) < 0) {close (sock);continue;}break;}
freeaddrinfo(res0);・・・© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

64

IPv6 Operator Development Program• IPv6 main feature• Basic knowledge for utilizing IPv6 on
Linux– IPv6 address text representation– IPv6 address typeyp
– ULA
– Header information– Dual Stack– DNS IPv6 support© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

65

IPv6 Operator Development Program

What is DNS’s IPv6 support• RR supportt– Returning AAAA
• Reverse
R
L
Lookupk iis same with
ith PTR
PTR, bbutt utilize
tili “i“ipv6.arpa”
6” tto”in-addr.arpa”. ipv6.int was used before instead of ipv6.arpa,
but not any more

– Supported on bind8.4 or later, bind9 or later• IPv6 transport
p supportpp– Conduct query transmission over IPv6 protocol– Register AAAA to your own FQDN
* AAAA reply can be transmitted using IPv4. You have to check the IPv6 ready DNS servermeans
ea s if thee RR iss supported,
suppo ed, thee transport
a spo iss supposupported,
ed, o
or bo
both oof them.
e© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

66

IPv6 Operator Development Program

OS support on DNS query• Revised DNS resolver (To keep the IPv4
communication quality)– Prioritize A record (FreeBSD, Windows Vista)• Mayy become a problempwhen IPv6 prevailp– Do not resolve AAAA record when NXDOMAIN is returned
when resolving A record (Windows Vista)– Determine the AAAA record process waiting time
according to the A record response time (FreeBSD,
Windows Vista)• Minimize theh timeout dduration whenh thereh
are no AAAA recordd• Suppress AAAA record resolution– Do not resolve the name with AAAA query unless the hosthave global IPv6 address (Windows Vista)© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

67

IPv6 Operator Development Program

DNS query order• Query order differs by OS– FreeBSD‐5.5R• Conduct the IPv4 and IPv6 name resolution one by one,and ends when the name is resolved– Windows XP SP2• Conduct all the IPv6 name resolution, and then move to
IPv4 name resolution– Windows
Wi d
Vi
Vista
t
• Conduct all the IPv4 name resolution first, and thenconduct IPv6 name resolution without those with
NXDOMAIN result© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

68

IPv6 Operator Development Program

IPv6 configuration and its confirmation on Linux• Network configuration basics– Basics of routing– IPv4/IPv6 address configuration and its
confirmation– IPv4/IPv6 routing confirmation– Bonding– Configurationgfiles– Tunneling• How to confirm the execution status© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

69

IPv6 Operator Development Program

IPv6 configuration and its confirmation on Linux• Network configuration basics– Basics of routing– IPv4/IPv6 address configuration and its
confirmation– IPv4/IPv6 routing confirmation– Bonding– Configurationgfiles– Tunneling• How to confirm the execution status© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

70

IPv6 Operator Development Program

Network Configuration Basics• In the Internet world, the data is encapsulated
in a IP pac
packetet aandd ttransmitted
a s tted in a bucbucketetrelay method– The destination name/address written on thepacket is IP address

IP address© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

71

IPv6 Operator Development Program

How the packet is transmitted

Application Layer

Application Layer

Transport Layer

Transport Layer

Network Layer

L3 Layer

L3 Layer

Network Layer

Data Link Layer

L2 Layer

L2 Layer

Data Link Layer

Physical Layer

L1 Layer

L1 Layer

Physical Layer

RouterRouter© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

72

IPv6 Operator Development Program

Class full world
Th IP addressesThe
dd
were separatedt d tto classesl
iin ththe original
i i l schemeh

IP Address Range

netmask

lengthClass A1 0 0 0-126
1.0.0.0
126.255.255.255
255 255 255

255 0 0 0
255.0.0.0/8Class B

128.0.0.0-191.255.255.255.255 255.255.0.0/16Class C

192.0.0.0-223.255.255.255/24

Example: Class B

128.2 .
Network Address

255.255.255.0

128.2.0.0/16

0. 0
Host Address
２^16-2 = 65534 addresses© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

73

IPv6 Operator Development Program

Emergence of subnets
E
Example:l Cl
Class B

128 2 .
128.2
Network Address

0 00.
Host Address

Example: Extend the network part using subnet scheme

128.2.100 . 0
Network Address

l thlengthS b netmask
Sub
t
k

H t
Hosts

/16

255.255.0.0

65534

/17

255.255.128.0

32766

/18

255 255 192 0
255.255.192.0

16382

/19

255.255.224.0

8190

/20

255.255.240.0

4094

/21

255.255.248.0

2046

/22

255.255.252.0

1022

/23

255.255.254.0

510

/24

255.255.255.0

254

/25

255.255.255.128

126

/26

255.255.255.192

62

/27

255.255.255.224

30

/28

255.255.255.240

14

/29

255.255.255.248

6/30

255.255.255.252

2

Host Address2^8-2 = 254 host address can be utilized© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

74

IPv6 Operator Development Program

In IPv6?
• It of course utilizes classless• You can consider the netmask to be /64
fixed as long as you utilize it in servers
128bits

Subnet prefix

Interface ID

64bit

64bit

Bits

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

75

IPv6 Operator Development Program

Routing Basics• Static routing– Routing uses longest prefix match– In generalgeneral, static routing is prioritized than dynamic routing– In general, direct connection is prioritized thanstatic routing
192.0.2.254

Wrong network topology: What happens in this case?

192 0 2 0/24
192.0.2.0/24

eth0:
th0 192
192.0.2.1
021

192.0.0.0/8

eth1

network

Next hop

MetircInterface0.0.0.0/0

192.0.2.254

0

eth0

192 0 2 0/24
192.0.2.0/24

0000
0.0.0.0

0

eth0
th0

192.0.0.0/8

0.0.0.00

eth1© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

76

IPv6 Operator Development Program• Network configuration basics– Basics of routing– IPv4/IPv6 address configuration and its
confirmation– IPv4/IPv6 routing confirmation– Bonding– Configurationgfiles– Tunneling• How to confirm the execution status© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

77

IPv6 Operator Development Program

Configuring IP address• Following commands are commonly usedg
IP address
to configure– ifconfig• format： ifconfig interface [aftype] options | address…

– ip• format：ip [OPTIONS] OBJECT { COMMAND | help }© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

78

IPv6 Operator Development Program

Configuring IPv4 address - ifconfig • ExampleE
l off IPv4
IP 4 addressdd
configurationfi
ti
IPv4 address configuration# ifconfig eth0 192.0.2.1 netmask 255.255.255.0
Confirm the configuration# ifconfig eth0p
HWaddr 00:00:XX:XX:XX:XX
eth0
Link encap:Ethernet
inet addr:192.0.2.1 Bcast:192.0.2.255 Mask:255.255.255.0
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
Interrupt:169
Activate the interface# ifconfig eth0 up
Inactivate the interface# ifconfig eth0 down

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

79

IPv6 Operator Development Program

IPv6 address configuration - ifconfig• ExampleE
l off IPv6
IP 6 addressdd
configurationfiti
IPv6 address configuration (You have to set the interface to “up”
up before the configuration)# ifconfig eth0 add 2001:db8::80/64
Deleting IPv6 address# ifconfig eth0 del 2001:db8::80/64
Confirm the configuration# ifconfig eth0
eth0
Link encap:Ethernet HWaddr 00:XX:XX:XX:XX:XX
inet addr:192.0.2.1 Bcast:192.0.2.255 Mask:255.255.255.0
inet6 addr: 2001:db8::80/64 Scope:Global
inet6 addr: fe80::2d0:xxxx:xxxx:xxxx/64 Scope:Link
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
Interrupt:169
Shuttinghiddown theh iinterfacef((Globall b l address
dd
will
ill b
be d
deletedld withi h shuthddown iin case off IPv6)
6)# ifconfig eth0 down
© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

80

IPv6 Operator Development Program

IPv4/IPv6 address configuration – ip command –Configuring IPv4/IPv6 addresses# ip addr add 192.0.2.1/24 dev eth0
# ip addr add 2001:db8::80/64 dev eth0
Confirm the configuration# ip addr show dev eth0
3: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
inet 192.0.2.1/24 brd 192.0.2.255 scope global eth0
inet6 fe80::202:xxx:xxx:xxx:xxx/64 scope link
valid_lft forever preferred_lft foreverinet6 2001:db8::80/64 scope global
valid_lft forever preferred_lft forever
Activate the interface# ip link set eth0 up
Inactivate the interface# ip link set eth0 down

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

81

IPv6 Operator Development Program

IPv4/IPv6 address configuration / lifetime# ip addr show dev eth0
3: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
inet 192.0.2.1/24 brd 192.0.2.255 scope global eth0
inet6 fe80::202:xxx:xxx:xxx:xxx/64 scope link
valid_lft forever preferred_lft foreverinet6 2001:db8::80/64 scope global
valid_lft forever preferred_lft forever© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

82

IPv6 Operator Development Program

Confirm the IPv4/IPv6 L2 address
In case of IPv4: Instead of ARP command# ip -4 neigh show
192.0.2.1 dev eth0 lladdr 00:00:XX:00:XX:XX REACHABLE
In case of IPv6:# ip -6 neigh show
2001:db8:0:1::dead:beaf dev eth0 lladdr 00:00:XX:XX:XX:XX router REACHABLE
fe80::XXX:XXXX:XXXX:XXXX dev eth0 lladdr 00:00:XX:XX:XX:XX router REACHABLE© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

83

IPv6 Operator Development Program

Routing configuration and confirmation
utilizing route command
Set the default route# route add –A inet default gw 192.0.2.254 dev eth0
# route add –A inet6 default gw fe80:x:x:x:x:x dev eth0
Set the route for each network# route add –net 192.0.2.0 netmask 255.255.255.0 gw 192.168.0.1 dev eth0
# route add –A inet6 2001:db8::/64 gw fe80::2d0:b7ff:fea0:beea dev eth0
Confirm the routing# route -n –A inet6# route –n –A inet

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

84

IPv6 Operator Development Program

Configuration and confirmation ofrouting with ip command
Set the Default route# ip route add default via 10.0.0.1 dev eth0
# ip
i routet add
dd ddefault
f lt via
i ffe80::202:b3ff:fe32:faa2
80 202 b3ff f 32 f 2 dev
d
eth0
th0
Set the route for each network# ip
p route add 192.0.2.0/24/
via 10.0.0.1 dev eth0
# ip route add 2001:db8::/48 via fe80::202:b3ff:fe32:faa2 dev eth0
Confirm the routing
# ip
i -4
4 routet showh# ip -6 route show

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

85

IPv6 Operator Development Program• Network configuration basics– Basics of routing– IPv4/IPv6 address configuration and its
confirmation– IPv4/IPv6 routing confirmation– Bonding– Configurationgfiles– Tunneling• How to confirm the execution status© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

86

IPv6 Operator Development Program

bonding• Utilized to establish redundant networks– No problem for utilization in IPv6

• Example
p of redundancyy usingg active-backupp/etc/modprobe d/bonding/etc/modprobe.d/bonding
alias bond0 bondingoptions
bond0 miimon=100 mode=1

eth0

eth1

bond0

ConfirmationCfiti$ cat /proc/net/bonding/bond0© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

87

IPv6 Operator Development Program• Network configuration basics– Basics of routing– IPv4/IPv6 address configuration and its
confirmation– IPv4/IPv6 routing confirmation– Bonding– Configurationgfiles– Tunneling• How to confirm the execution status© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

88

IPv6 Operator Development Program

About configuration files (in general)
Files ffor name resolution
Fil
l ti
/etc
hosts – Matchingg list of IP address and host names
resolv.conf – Resolver configuration fileh thost.conf
f – ResolverRlconfigurationfi
ti filfile
127.0.0.1

hoge.example.jp

localhost hoge

# The following lines are desirable for IPv6 capable hosts::1
ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00 0 i
ff00::0
ip6-mcastprefix
6tfi
ff02::1 ip6-allnodes
search example.jp
ff02::2 ip6-allroutersnameserver 192.0.2.254
ff02::3 ip6-allhosts
order hosts,bindmulti on© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

89

IPv6 Operator Development Program

About configuration files (in general)
Files used for resolving service names
names, etc/etc
services : Network service list
protocolstl :PProtocoltl definitiond fi iti fil
filetcpmuxecho
echo
discarddiscardsystatdaytimedaytimenetstat
qotd
msp
msp
p
chargenchargen
ftp-data
ftp
fsp
ssh
ssh
- Omitted -

1/tcp
7/tcp
7/udp
9/tcp
9/udp
11/tcp13/tcp13/udp15/tcp17/tcpip 18/tcp
0
18/udp#hopopt 0p
icmp19/tcp
1
19/udpigmp
220/tcpggp
3
21/tcpipencap4
st 21/udp
5
22/tcptcp
6
22/udpegp
8# TCP port service multiplexer

sink nullsink null
users

quote
# message
send protocolIP# internet
protocol,pseudo protocol number
HOPOPT# IPv6 Hop-by-Hop
Hop by Hop Option [RFC1883]
ICMPttytst source# internet control message protocol
IGMPttytst source# Internet Group Management
GGP# gateway-gateway protocol
IP-ENCAP# IP encapsulated in IP (officially ``IP'')
fspd
ST# ST datagram mode
# SSH Remote Login Protocol
TCP# transmission control protocol
EGP# exterior gateway protocol© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

IPv6 Operator Development Program

About configuration files
CentOS/etc

Debiansysconfig
yg
network : Network option configuration, etc
network-scripts
ifcfg-{dev} : Network interface configuration etc

/ t
/etc
network
options : Network option configurationinterfaces : Network interface configurationg* Recent Debian/Ubuntu will not reflect the configuration when network-manager package is installed.
© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

91

IPv6 Operator Development Program

Network configuration on CentOS/etc/sysconfig/network
HOSTNAME=hoge.example.jp# IPv4NETWORKING=yes
GATEWAY=192.0.2.254#IPv6
NETWORKING_IPV6=yes
IPV6_DEFAULTGW=fe80::xxxx%eth0#IPV6_AUTOCONF=no#IPV6FORWARDING=no
HOSTNAME
Write FQDN
NETWORKING
yes: Run rc script network
GATEWAY
Specify the IPv4 network default gateway
NETWORKING_IPV6
yes: Enable IPv6 network
IPV6_DEFAULTGWSpecify the IPv6 network default gateway© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

92

IPv6 Operator Development Program

Network configuration on CentOS/etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
BOOTPROTO=none
ONBOOT=yes
ONBOOT
yes
NETWORK=192.0.2.0
NETMASK=255.255.255.0
IPADDR=192.0.2.1
IPV6INIT yes
IPV6INIT=yes#IPV6_AUTOCONF=no
IPV6ADDR=2001:db8::80/64
ETHTOOL_OPTS="autoneg off speed 100 duplex full"

DEVICE
Physical interface name
BOOTPROTO
none : unused
bootp: utilize BOOTP
dhcp : utilize DHCPONBOOTyes : Activate on bootno : Not activate on boot

IPADDR
IPv4 address without netmask
NETWORK
Specify network address for IPv4
NETMASKSpecify netmask for IPv4

IPV6INIT
yes: Enable IPv6 initialization
No : Do not enable IPv6 initialization
IPV6ADDR
IPv6 address / netmask
ETHTOOL_OPTS
Specify options to ethtool© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

93

IPv6 Operator Development Program

Network configuration on Debian (obsolete)/etc/network/options
ip_forward=nospoofprotect=yes
syncookies=noki
ip_forward
yes: Configure when utilizing Linux as a Routerspoofprotect
yes: Reverse Path is verified. Configuration recommended whenconnected to Stub network
syncookies
yes: Issue cookies to deal against TCP syn flooding attack/etc/network/options became obsolete, and replaced to /etc/sysctl.conf/etc/sysctl.conf
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp filter = 1
net.ipv4.conf.default.rp_filter
net.ipv4.conf.all.rp_filter = 1
net.ipv4.tcp_syncookies = 1© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

94

IPv6 Operator Development Program/etc/network/interface

Debianのネットワーク設定

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
address 192.0.2.1
192 0 2 1
netmask 255.255.255.0
gateway 192.0.2.254# dns-serarch example.jp# dns-nameserversd
192 0 2 254
192.0.2.254
up ethtool -s eth0 autoneg off speed 100 duplex fulliface eth0 inet6 static
address
dd
2001:db8::80
2001 db8 80
netmask 64
gateway fe80::xxx%eth0
pre uppre-upRun command before bringing the interface up
up
Command executed when interface is up
post-up
post
up
Run command after bringing the interface up

pre down
pre-down
Run command before taking the interface down
down
Command executed when interface is down
post-down
post
down
Run command after taking the interface down

Also See man interfaces© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

95

IPv6 Operator Development Program• Network configuration basics– Basics of routing– IPv4/IPv6 address configuration and its
confirmation– IPv4/IPv6 routing confirmation– Bonding– Configurationgfiles– Tunneling• How to confirm the execution status© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

96

IPv6 Operator Development Program

Tunneling• Tunnel is point-to-point connection– When the address destination is not the device, it willconsider it is for the tunnel counterpart– It is normal to assign /64 to networks• When a packet with destination address 2001:db8:20:1000::3
is transmitted…

2001:db8:20:1000::/64

2001:db8:20:1000::1

2001:db8:20:1000::2© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

97

IPv6 Operator Development Program• Network configuration basics– Basics of routing– IPv4/IPv6 address configuration and its
confirmation– IPv4/IPv6 routing confirmation– Bonding– Configurationgfiles– Tunneling• How to confirm the execution status© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

98

IPv6 Operator Development Program

Connection confirmation• Easy connection confirmation method– Connection confirmation using ping
– Connection confirmation using traceroute• You can onlyy see the outbound route byy traceroute

Outbound and inbound route may differ…
© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED.

99

IPv6 Operator Development Program

Connection confirmation using Ping(ICMP)• Ping to the default gateway
Connection confirmation of IPv4 route$ pingi-c 10 192
192.0．2.254
0 2 254
PING 192.0.2.254 (192.0.2.254) 56(84) bytes of data.
64 bytes from 192.0.2.254: icmp_seq=1 ttl=255 time=2.09 ms
64 bytesyfrom 192.0.2.254: icmp
p_seq=2qttl=255 time=2.04 ms
64 bytes from 192.0.2.254: icmp_seq=3 ttl=255 time=4.30 ms
64 bytes from 192.0.2.254: icmp_seq=4 ttl=255 time=2.00 ms
64 bytes from 192.0.2.254: icmp_seq=5 ttl=255 time=2.01 ms
64 bytesb t
fromf
192.0.2.254:
192 0 2 254 icmp_seq=6i
6 ttl=255
ttl 255 time=2.02
ti
2 02 ms
64 bytes from 192.0.2.254: icmp_seq=7 ttl=255 time=2.03 ms
64 bytes from 192.0.2.254: icmp_seq=8 ttl=255 time=2.62 ms
64 bytesyfrom 192.0.2.254: icmp
p_seq=9qttl=255 time=3.84 ms
64 bytes from 192.0.2.254: icmp_seq=10 ttl=255 time=4.77 ms--- 192.0.2.254 ping statistics --10 packets
k t transmitted,t
itt d 10 received,
i d 0% packet
k t loss,
l
time
ti
9036
9036msrtt min/avg/max/mdev = 2.009/2.776/4.774/1.038 ms© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 100

IPv6 Operator Development Program

Connection confirmation using Ping(ICMP)• Ping to the default gateway
Connection confirmation of IPv6 route$ ping6 -c 10 fe80::2000:1 -I eth0
PING fe80::2000:1(fe80::2000:1)
f 80 2000 1(f 80 2000 1) f
from ffe80::2d0:b7ff:fea0:beea
80 2d0 b7ff f 0 b
eth1: 56 data bytes
64 bytes from fe80::2000:1: icmp_seq=1 ttl=64 time=2.38 ms
64 bytesyfrom fe80::2000:1: icmp
p_seq=2qttl=64 time=7.71 ms
64 bytes from fe80::2000:1: icmp_seq=3 ttl=64 time=7.47 ms
64 bytes from fe80::2000:1: icmp_seq=4 ttl=64 time=2.41 ms
64 bytes from fe80::2000:1: icmp_seq=5 ttl=64 time=2.39 ms
64 bytesb t
fromffe80::2000:1:
f 80 2000 1 icmp_seq=6i
6 ttl=64
ttl 64 time=3.91
ti
3 91 ms
64 bytes from fe80::2000:1: icmp_seq=7 ttl=64 time=5.00 ms
64 bytes from fe80::2000:1: icmp_seq=8 ttl=64 time=2.29 ms
64 bytesyfrom fe80::2000:1: icmp
p_seq=9qttl=64 time=2.30 ms
64 bytes from fe80::2000:1: icmp_seq=10 ttl=64 time=2.32 ms--- fe80::2000:1 ping statistics --10 packets
k t transmitted,t
itt d 10 received,
i d 0% packet
k t loss,
l
time
ti
9036
9036msrtt min/avg/max/mdev = 2.292/3.822/7.711/2.069 ms© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 101

IPv6 Operator Development Program

Hasn’t got the speed?
• Confirm
C fi ththe EthEthernett C
Cardd iis configuredfidas Full Duplex
Confirm the current configuration# ethtool eth0
Configure to Full-duplex# ethtool -s eth0 autoneg off speed 100 duplex fullConfirm the current configuration# mii-tool eth0
Configure to Full-duplex
Full duplex# mii-tool -F 100baseTx-FD eth1
© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 102

IPv6 Operator Development Program

Control with sysctl• IPv6 auto-configuration
auto configuration will be executed
when the interface is brought to up. Disable
the unnecessary configurations beforehand# sysctl –w net.ipv6.conf.eth0.accept_ra=0• Dealingg againstg
TCP Syn
y flooding
g attack# sysctl –w net.ipv4.tcp_syncookies=1• Ignore ICMP destined to Broadcast# sysctl
tl –w net.ipv4.icmp_echo_ignore_broadcasts
t i 4 ih ibdt
© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 103

IPv6 Operator Development Program

Confirm the execution status© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 104

IPv6 Operator Development Program

Server status check• Which programs are running?
– ps command# ps aux | less• Listening to which ports?
– netstat– fuser© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 105

IPv6 Operator Development Program

Server status check (netstat)• Utilize
Utili netstat
t t t tot display
di l server’s’ lilistent portt
Major options-l, --listening
Show only listening sockets-p, --program
Show the PID and name of the program to which each socket belongs-n,, --numericShow numerical addresses instead of trying to determine symbolic
host, port or user names.
-tt,--tcp
tcpShow host TCP statistics-u,--udp
Show host UDP statistics© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 106

IPv6 Operator Development Program

Server status check (netstat)E
Execution
ti examplel# netstat -ltupn
Proto Recv
Recv-Q
Q Send-Q
Send Q Local Addresstcp
0
0 127.0.0.1:993
tcp
00 127.0.0.1:111
tcp
00 192.0.2.1:53
tcp
00 127.0.0.1:53
tcp
0
0 0
0.0.0.0:5432
0 0 0:5432
tcp
0
0 0.0.0.0:25
tcp
00 127.0.0.1:953
tcp6
0
0 :::80tcp6
00 :::53
tcp6
0
0 :::22tcp6
00 :::5432
udp
0
0 0.0.0.0:32768
udp
0
0 127.0.0.1:161
udp
p0
0 192.0.2.1:53
udp
0
0 127.0.0.1:53
udp
0
0 127.0.0.1:111
udp6
0
0 :::32769
udp6
0
0 :::53

Foreign Address
0.0.0.0:*
0.0.0.0:*
0.0.0.0:*
0.0.0.0:*0
0.0.0.0:*0 0 0:*
0.0.0.0:*
0.0.0.0:*
:::*
:::*
:::*
:::*
0.0.0.0:*
0.0.0.0:*
0.0.0.0:*
0.0.0.0:*
0.0.0.0:*
:::*
:::*

State
LISTENLISTENLISTENLISTENLISTENLISTENLISTENLISTENLISTENLISTENLISTEN

PID/Program name3785/famd
3175/portmap
3380/named
3380/named
3619/postmaster3596/master
3380/named
11254/apache2
3380/named
3659/sshd
3619/postmaster
3380/named
3653/snmpd
3380/named/
3380/named
3175/portmap
3380/named
3380/named* You can specify address family with ”-A” option (inet or inet6)© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 107

IPv6 Operator Development Program

Notes in netstat• Due to netstat character display
p ylimitation, IPv6 addresses longer thancertain length will not be displayed• net-tool_1.60-22 or later in Debianpackagekcan didisplayl allll th
the iinformationfti
with ”-W/--wide” options© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 108

IPv6 Operator Development Program

Server status check with ss• Optionsp
are almost same with netstat, but
IPv6 addresses will not be abbreviated$ ss -ltun
ltun
Netid Recv-Q Send-Q
tcp
0
50
tcp
0
128
tcp
0
128
t
tcp
0
5
tcp
0
3
tcp
0
3
tcp
0
3
tcp
0
128
tcp
0
128
tcp
0
128
tcp
0
128
tcp
0
100
tcp
0
100
tcp
0
3

Local Address:Port
127.0.0.1:3306
*:111
:::80
127
127.0.0.1:33843
0 0 1 33843
192.0.2.136:53
127.0.0.1:53:::53
127.0.0.1:631
127.0.0.1:5432::1:953127.0.0.1:953
:::25
*:25
:25
*:1723Peer Address:Port
*:*
*:*
:::*
*
*:*
*
*:*
*:*
:::*
*:*
*:*
:::*
*:*
:::*
*:*
:
*:*

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 109

IPv6 Operator Development Program

Server status check (fuser)• Specify the listening process through server
listening
gp
port using
g ｆuser# fuser -vn tcp 80

80/tcp:USER
root
www-data
www-data
www-data
www-data
www-data
www-data
www-data
www-data

PID ACCESS COMMAND
4699 F.... apache
4706 F.... apache
4707 F....
F
apache4708 F.... apache
4709 F.... apache4710 F.... apache
8407 F.... apache
8408 F.... apache
8409 F.... apache© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 110

IPv6 Operator Development Program

Basic service configurations• DNS (bind9)• SMTP (postfix)• ＰＯＰ server (dovecot)• Apache• NTP© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 111

IPv6 Operator Development Program• DNS(bind9)• SMTP(postfix)• ＰＯＰ server (dovecot)• Apache• NTP© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 112

IPv6 Operator Development Program

DNS• To enable BIND9 IPv6 transport,p
configureg
the listen-on-v6
options {directory "/var/named";
listen-on-v6 { any; };…
..
.

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 113

IPv6 Operator Development Program

DNS• ACL configurationg
examplep– You can input specific addresses like IPv4
acl “slaves” {192.0.2.1;
2001:db8::53;
127.0.0.1;::1;};// slave server// slave server// for debug// for debug© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 114

IPv6 Operator Development Program

DNS• AAAA RR registrationg
examplep;; Server;;
e ample jp
example.jp
www
IN
A
www
IN
AAAA

192.0.2.1
2001:db8::1• AAAA RR confirmation$ didig www.example.jp
l j AAAA© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 115

IPv6 Operator Development Program

DNS• IPv6 reverse lookup configuration;; IPv6 PTR for 2001:db8::/64
zone “0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ipv6.arpa” {type master;
file “2001.0db8.0000.000.reverse”;
allow-transfer { slaves; };allow-query { any };}1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0

IN

PTR

www.example.jp.

• IPv6 reverse lookup configuration confirmation$ dig –x 2001:db8::1© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 116

IPv6 Operator Development Program

DNS: Configuration at resolver• Configure IPv6 address to /etc/resolv.conf,
same as IPv4
search example.jp
nameserver 192.0.2.254
nameserver 2001:db8::53© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 117

IPv6 Operator Development Program• DNS(bind9)• SMTP(postfix)• ＰＯＰ server (dovecot)• Apache• NTP© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 118

IPv6 Operator Development Program

Enable IPv6 in postfix• /etc/postfix/main.cf
p# inet_protocols = ipv4
# inet_protocols = ipv4, ipv6 # equivalent to all# inet_protocols
i tt
l = ipv6
i 6
inet_protocols = allThat’s all…

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 119

IPv6 Operator Development Program

Limit the addresses to Listen• /etc/postfix/main.cf
p# inet_interfaces = alll
# inet_interfaces = loopback-only
inet_interfaces = 127.0.0.1, [::1], [2001:db8::25]© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 120

IPv6 Operator Development Program

Fix the sending address• /etc/postfix/main.cf
p*smtｐ_bind_address6 = 2001:db8::25* You can also configure at master.cf© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 121

IPv6 Operator Development Program

Characters that have to be enclosed in []• When configuringg
gp
postfix match list suchas mynetworks and debug_peer_list, youhave to enclose the IPv6 addresses with []not to mix with “type:table” format.
# mynetworks = hash:/etc/postfix/network_table
mynetworks = 127.0.0.0/8
12 0 0 0/8 [::1]/128
1 /128© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 122

IPv6 Operator Development Program• DNS(bind9)• SMTP(postfix)• ＰＯＰ server (dovecot)• Apache• NTP© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 123

IPv6 Operator Development Program

Enabling IPv6 in Dovecot• No need for special configuration. Too muchcomplex configuration related to listen address
specification cannot be done in CentOS5 group
Dovecot.
• /etc/dovecot.conf# Listen to all interfaces IPv4 address when# specifying “*”#Listen = *## Listen to all interfaces IPv6 address when# specifying “[::]”. Some OS listen to all# interface IPv4 with this configuration
configuration.
#Listen = [::]© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 124

IPv6 Operator Development Program• DNS(bind9)• SMTP(postfix)• ＰＯＰ server（dovecot)• Apache• NTP© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 125

IPv6 Operator Development Program

Apache configuration• There are no specialp
configurationsg– Supports IPv6 from Apache2.0– Will mention about the IPv6 dependencies
from here after© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 126

IPv6 Operator Development Program

ListenAddresses have to be enclosed with [] unlike IPv4

Listen [2001:db8::a00:20ff:fea7:ccea]:80© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 127

IPv6 Operator Development Program

Access control using ACL / address• Note that you cannot configure as
2001 db8 0 1000/64 Y
2001:db8:0:1000/64.
You hhave tto specify
if th
the
network address.
AuthName “Staff Only”
AuthType BasicAuthUserFile
ut Usee “/var/www/www.example.jp/.htpasswd”/ a //.e a p e.jp/. tpass d
Require valid-user
Order Deny,Allow
Deny from all
Allow from 192.168.1.1
Allow from 2001:db8:0:1000::/64
S ti f A
Satisfy
Any© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 128

IPv6 Operator Development Program

Address base VirtualHost
You have to enclose the addresses with [] unlike IPv4, sameas Listen#<VirtualHost *:80><VirtualHost [2001:db8:0:1000::80]:80>[]
ServerName www.example.co.jp…
..
.
</VirtualHost>© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 129

IPv6 Operator Development Program

Access log
Below is the common log output example
2001:db8:0:1000:211:24ff:dead:beaf - - [04/Nov/2008:09:30:59 +0900] "GET /favicon.ico HTTP/1.1" 404 272
192 0 2 1 - - [04/Nov/2008:09:35:59
192.0.2.1[04/N /2008 09 35 59 +0900]
0900] "GET /favicon.ico/f i
i HTTP/1.1"
HTTP/1 1" 404 272* When running Apache on Linux, IPv6 socket processes IPv4
connections, but the IPv4 address on the log is described
192 0 2 1 and not ::ffff:192
192.0.2.1::ffff:192.0.2.1
021© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 130

IPv6 Operator Development Program

Configuration files layout example
Server configuration file/etc/apache
httpd.conf

Data file/var/www/www.example.com/

htdocsdocs
conf
cgi-bin
error
icons
logs

Obtain VirtualHost configurations
using include option

Specify server FQDN as
the directory name• Advantage
Even when the number of operating VirtualHost changes, directory layout
does not change
Full backup of each VirtualHost can be done by specifying the directory• Disadvantage
As this is not the standard configuration, you have to double check such as© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 131
when using the logrorate

IPv6 Operator Development Program• DNS (bind9)• SMTP (postfix)• ＰＯＰ Server (dovecot)• Apache• NTP© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 132

IPv6 Operator Development Program

NTP• Specifypy upper
pp level NTP server– You can specify using FQDN and IPv6
addresses
serverserver

ntp1.v6.mfeed.ad.jp
2001:3a0:0:2005::57:123© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 133

IPv6 Operator Development Program

NTP• Limit the queryq y– With restrict command, you can utilize
IPv4/IPv6 addresses, but you are supposed to
specify the addresses with ”-4”, “-6” options#restrict -4
4 default kod notrap nomodify nopeer noquery#restrict -6 default kod notrap nomodify nopeer noquery#restrict 127.0.0.1#restrict ::1
restrict -4 192.0.2.0 mask 255.255.255.0 knod notrap nomodify nopeer noquery
restrict -6 2001:db8:: mask ffff:ffff:ffff:ffff:: knod notrap nomodify nopeer#restrict 192.168.123.0 mask 255.255.255.0 notrust© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 134

IPv6 Operator Development Program

NTP• Synchronization check can be done using
ntpq command same as IPv4
IPv4. (But the
information will be abbreviated)$ ntp -pnremoterefid
st t when poll reachdelay
offset jitter==============================================================================
2001:3a0:0:2001 210.173.160.86
2 u
57
64
1
3.195
9.845
0.002
2001:3a0:0:2005 210.173.160.56
2 u
56
64
1
3.173
9.871
0.002

$ ntp –pnremoterefid
st t when poll reachdelay
offset jitter==============================================================================
2001:3a0:0:2001 210.173.160.56
2 u
29
64
77
3.130
5.788
2.341
*2001:3a0:0:2005 210.173.160.86
2 u
33
64
77
3.173
9.871
4.693

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 135

IPv6 Operator Development Program• Measuring
g IPv6 traffics ((MRTG))• IPv6 ready tools– Smokeping– Nagios© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 136

IPv6 Operator Development Program

Measuring the traffic using MRTG
• If the following
g Perl module is alreadyyinstalled, MRTG can acquire the datausing IPv6 (cfgmaker is also IPv6 ready)– Socket6– IO::Socket::INET6IO S k t INET6• When measuring
g the data in IPv6,, do notforget the following configuration
E bl IP 6 yes
EnableIPv6:© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 137

IPv6 Operator Development Program

Traffic monitoring of IPv6
• Normal MIB cannot acquireq
IPv6 onlyytraffic, so you have to work on it• You can acquire IPv6 only traffic bymeasuring the packets using ip6tables© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 138

IPv6 Operator Development Program

MRTG configuration• You can create ggraphsp usingg data from
MRTG with external scripts not just SNMP
Target[Linux]: `/usr/local/bin/v6counter.pl`© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 139

IPv6 Operator Development Program

Using ip6tables#!/usr/bin/perl# for IPv6 traffic counting#
use strict;
use warnings;######################################### Edit following values.
########################################
my $ip6tables_cmd = '/sbin/ip6tables';my $head_cmd= '/usr/bin/head';######################################### Main Routine#
my $input;
my $output;{
foreach my $TARGET qw/INPUT OUTPUT/ {chomp(myp( y $data = `$ip6tablesp_cmd -vnx -L $TARGET --line-number | $head_cmd -1`););
my @counter = split(/¥s+/, $data);
if ($data =~ /INPUT/) {$input = $counter[6];} else {$output = $counter[6];}}print "$input¥n$output¥n";}© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 140

IPv6 Operator Development Program• Measuring
g IPv6 traffics ((MRTG))• IPv6 ready tools– Smokeping– Nagios© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 141

IPv6 Operator Development Programsmokeping• Measuring
g the network latencyy– Port monitoring other than ICMP monitoring is
also possible with addition of probe• Site– http://oss.oetiker.ch/smokeping/© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 142

IPv6 Operator Development Program

IPv6 support on Smokeping• Specify fping6 at Probe+ FPing6
FPi g6binary = /usr/sbin/fping6• Specify the configured Fping6 at Probe
When using Fping6 for standard Probe
probe = FPing6
menu = Toptitle = Network Latency Grapher+ Servers
menu= Server
title = Server++ server1
menu = server1
title= server1
host = www.example.jp

Standard Probe is used with Fping++ server1
probe=FPing6
menu = server1
title= server1
host = www.example.jp© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 143

IPv6 Operator Development Program

Nagios• Integratedgmonitoringg tool– Flexible monitoring other than ICMP
monitoring is possible using plug-ins
plug ins• Site– http://www.nagios.org/© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 144

IPv6 Operator Development Program

Nagios IPv6 support• Most of the plugins support IPv6 already, andyou just have to specify the IPv6 address at$HOSTADDRESS$. If you’re using FQDN, youhavea e to dedefinee a cocommend.
e ddefine command {command_namecommand_line$ARG1$ -c $ARG2$ -p 5 -6}
define command {command_namecommand_line$ARG1$ -c $ARG2$ -p 5 -4}check_ping6$USER1$/check_ping –H $HOSTADDRESS$ -w

check_ping4$USER1$/check_ping –H $HOSTADDRESS$ -w© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 145

IPv6 Operator Development Program

Security• Packet filter– Path MTU Discovery– Extension header– ip6tables
i 6t bl overviewi– ip6tables configuration• ACL– tcp_wrappers
tcp wrappers– Mapped_address– FQDN© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 146

IPv6 Operator Development Program• Packet Filter– Path MTU Discovery– Extension headers– ip6tables
i 6t bl overviewi– ip6tables configuration• ACL– tcp_wrappers
tcp wrappers– mapped_address– FQDN© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 147

IPv6 Operator Development Program

About packet filtering• Unlike IPv4, the communication might
g stoppwhen you filter all the ICMP messages in
IPv6• Why ICMPv6 is mandatory?
– Fragmentation at intermediate routes is notallowed in IPv6 in order to decrease the loadof intermediate routers. Therefore, Path MTU
Discovery is required to transmit packets.
(Path MTU Discovery requires ICMPv6)© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 148

IPv6 Operator Development Program

Path MTU Discovery••••

Source host assumes forwarding link’s MTU as its path MTU
When it is unable to forward packets at intermediate routes, a router discards thepacket and sends back the Packet Too Bigg (ICMPv6
p(
type2)message
yp )g to the source
address (Inserts the MTU information of the link to the next hop)
IPv6 minimum MTU is 1280 byte
Same with multicast– Allll theh ddestination address’s
dd’ minimum MTU•

Discarded when the packets got filtered by L2SW’s MTU
MTU1500

MTU1454

MTU1500

MTU1280

MTU1500
ServerclientSize=1500

Packet Too Big (MTU=1454)

Packet Too Big (MTU=1280)

Size=1454
Size=1280© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 149

IPv6 Operator Development Program

Basics of packet filtering• As IPv6 assumes end‐to‐end communication, security should
be assured at each end node.
node• Precaution in IPv6
– Do not filter ICMPv6• Especially type2 (Packet Too Big)

– Pass EDNS0 and TCP53• As DNS response tend to be big in IPv6, these messages are necessary• Dealing with extension header– Simple packet filtering does not support all features• RH0, fragment header, etc– Consideration
C id ti is
i necessary whenh configuring
fi i fi
firewallsll© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 150

IPv6 Operator Development Program

Packet filter 1 (Reference)
Ingress

EgressMandatory
M[1] Accept all ICMPv6[2] Reject packets with following source address‐ Reserved address::/8‐ Deprecate‐site local address
fec0::/10‐ Unique local address
fc00::/7‐ Multicast address
ff00::/8‐ Document address
2001:db8::/32[3] Reject the packets with source address with its own AS’s prefix(transit connection)

none

Optio
on

[1] Limit the ICMPv6 packets destined to border interface‐Prerequisiteq
1. Accept ICMPv6 TYPE that are used in Neighbor Discovery
2. Accept ICMPv6 TYPE =2 (Packet Too Big) used in Path MTU
Discovery
3.Accept ICMPv6 TYPE = 1 (Destination Unreachable) in order torealize fast IPv6/IPv4 fallback.
[2] Reject ICMPv6 other than then above described ones destined
to border interfaces.
*** Unable to confirm traceroute, ping otherwise[3] Reject 6bone address (obsolete) 3FFE::/16[1] Accept all ICMPv6[[2]] Rejectj the ppackets with followingg source address‐ Reserved address::/8‐ Deprecate‐site local address
fec0::/10‐ Unique local address
fc00::/7‐ Multicast address
ff00::/8‐ Document address
2001:db8::/32‐ 6bone address
3FFE::/16Referred to: http://www.janog.gr.jp/doc/janog-comment/jc1006.txt© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 151

IPv6 Operator Development Program

Packet Filter 2.1 (Reference)
Recommendations for ICMPv6 Transit Traffic

Traffic that Must Not be Dropped

Traffic that Normally Should Not be Dropped

Traffic That Will Be Dropped Anyway(All these messages should never be propagatedbeyond the link which they were initially transmitted)

Traffic for Which a Policy Should Be Defined

Destination Unreachable (Type 1) ‐ All codes
Packet Too Big (Type 2)
Time Exceeded (Type 3) ‐ Code 0 only
Parameter Problem (Type 4) ‐ Codes 1 and 2 only
Echo Request (Type 128)
Echo Response (Type 129)
Time Exceeded (Type 3) ‐ Code 1
Parameter Problem (Type 4) ‐ Code 0Home Agent Address Discovery Request (Type 144)
Home Agent Address Discovery Reply (Type 145)
Mobile Prefix Solicitation (Type 146)
Mobile Prefix Advertisement (Type 147)
Router Solicitation (Type 133)
Router Advertisement (Type 134)
Neighbor Solicitation (Type 135)
Neighbor Advertisement (Type 136)
Redirect (Type 137)
Inverse Neighbor Discovery Solicitation (Type 141)
Inverse Neighbor Discovery Advertisement (Type 142)
Listener Query (Type 130)
Listener Report (Type 131)
Listener Done (Type 132)
Listener Reportp v2 ((Typeyp 143))
Certificate Path Solicitation (Type 148)
Certificate Path Advertisement (Type 149)
Multicast Router Advertisement (Type 151)
Multicast Router Solicitation (Type 152)
Multicast Router Termination (Type 153)
Seamoby Experimental (Type 150)
Unallocated Error messages (Types 5‐99 inclusive and 102‐126 inclusive)
Unallocated Informational messages (Types 154‐199 inclusive and 202‐254 inclusive)

Referred to: http://www.ietf.org/rfc/rfc4890.txt?number=4890© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 152

IPv6 Operator Development Program

Packet Filter 2.2 (Reference)
Recommendations for ICMPv6 Local Configuration Traffic

Traffic that Must Not be Dropped

Traffic that Normally Should Not be Dropped
Traffic That Will Be Dropped Anyway(if the service is not implemented)

Traffic for Which a Policy Should Be Defined

Destination Unreachable (Type 1) ‐ All codes
Packet Too Big (Type 2)
Time Exceeded (Type 3) ‐ Code 0 only
Parameter Problem (Type 4) ‐ Codes 1 and 2 only
Echo Request (Type 128)
Echo Response (Type 129)
Router Solicitation (Type 133)
Router Advertisement (Type 134)
Neighbor Solicitation (Type 135)
Neighbor Advertisement (Type 136)
Inverse Neighbor Discovery Solicitation (Type 141)
Inverse Neighbor Discovery Advertisement (Type 142)
Li t
Listener
Q
Query (T(Type 130)
Listener Report (Type 131)
Listener Done (Type 132)
Listener Report v2 (Type 143)
Certificate Path Solicitation (Type 148)
Certificate Path Advertisement (Type 149)
Multicast Router Advertisement (Type 151)
Multicast Router Solicitation (Type 152)
Multicast Router Termination (Type 153)
Time Exceeded (Type 3) ‐ Code 1
Parameter Problem (Type 4) ‐ Code 0
Router Renumbering (Type 138)
Home Agent Address Discovery Request (Type 144)
Home Agent Address Discovery Reply (Type 145)
Mobile Prefix Solicitation (Type 146)
Mobile Prefix Advertisement (Type 147)
Seamoby Experimental (Type 150)
Redirect (Type 137)
Node Information Query (Type 139)
Node Information Response (Type 140)
Unallocated Error messages (Types 5‐99 inclusive and 102‐126 inclusive)

Referred to: http://www.ietf.org/rfc/rfc4890.txt?number=4890© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 153

IPv6 Operator Development Program

ip6tables overview• IPv6 version of iptables– Packet filter rules in kernels can be configured– About the same with IPv4 except the NAT
related configurations
configurations. Note that ICMP and
ICMPv6 does not have compatibility.
– SinceSi
ConnectionCti tracking
t ki iis nott supportedt d iin
RHEL5/CentOS5, configuration can be done,b td
but
does nott work
k as expected.
t d
Example:ip6tables -A TEST -m state --state RELATED,ESTABLISHED -j ACCEPT© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 154

IPv6 Operator Development Program

Ip6tables configuration• Defines rules to each targetg
INPUT

ROUTINGINPUTFORWARDOUTPUTOUTPUT
LOCAL PROCESS© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 155

IPv6 Operator Development Program

ICMPv6 configuration sample# Allow some ICMPv6 types in the INPUT chain# Using ICMPv6 type names to be clear.
ip6tables -A INPUT -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT# Allow some other types in the INPUT chain, but rate limit.
ip6tables -A
A INPUT -p
p icmpv6 --icmpv6-type
icmpv6 type echo
echo-request
request -m
m limit --limit
limit 900/min -jj ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-reply -m limit --limit 900/min -j ACCEPT# Allow others ICMPv6 types but only if the hop limit field is 255.
ip6tables -A
A INPUT -p
p icmpv6 --icmpv6-type
icmpv6 type router-advertisement
router advertisement -m
m hl --hl-eq
hl eq 255 -jj ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -m hl --hl-eq 255 -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -m hl --hl-eq 255 -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type redirect -m hl --hl-eq 255 -j ACCEPT# When there isn't a match, the default policy (DROP) will be applied.
# To be sure, drop all other ICMPv6 types.
# We're dropping enough icmpv6 types to break RFC compliance.
ip6tables -A INPUT -p icmpv6 -j LOG --log-prefix "dropped ICMPv6"
ip6tables -A INPUT -p icmpv6 -j DROP

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 156

IPv6 Operator Development Program

ICMPv6 configuration sample（Cont)# All
Allow ICMPv6
ICMP 6 typest
that
th t should
h ld beb sentt throughthh th
the IInternet.
tt
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type destination-unreachable -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type packet-too-big -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type time-exceeded -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type parameter-problem -j ACCEPT# Limit most NDP messages to the local network.
ip6tablesp-A OUTPUT -p
p icmpv6
p --icmpv6-typep
yp neighbour-solicitationg-m hl --hl-eq
q 255 -jj ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbour-advertisement -m hl --hl-eq 255 -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type router-solicitation -m hl --hl-eq 255 -j ACCEPT# If we're acting like a router, this could be a sign of problems.
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type router-advertisement -j LOG --log-prefix "ra ICMPv6 type"ip6tables -A OUTPUT -p icmpv6 --icmpv6-type redirect -j LOG --log-prefix "redirect ICMPv6 type"ip6tables -A OUTPUT -p icmpv6 --icmpv6-type router-advertisement -j REJECT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type redirect -j REJECT# Accept all other ICMPv6 types in the OUTPUT chain.
ip6tables -A OUTPUT -p icmpv6 -j ACCEPT

Reference: http://www.cert.org/downloads/IPv6/ip6tables_rules.txt© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 157

IPv6 Operator Development Program

Security• Packet filter– Path MTU Discovery– Extension headers– ip6tables
i 6t bl overviewi– ip6tables configuration• ACL– tcp_wrappers
tcp wrappers– Mapped_address– FQDN© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 158

IPv6 Operator Development Program

tcp_wrappers• tcp_wrappers
p_
pp
is p
plural because this isprovided in library format, too. This is why
many distribution’s
distribution s sshd can control thefilter with following files without tcpd.
– /etc/hosts.allow/ t /h t ll
– /etc/hosts.deny© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 159

IPv6 Operator Development Program

tcp_wrappers format• IPv6 and network address have to be
enclosed with [].
ALL: [2001:db8:1000:2000::]/64*) The format maybe different with new releases, and you should be carefulwhen referring to old books© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 160

IPv6 Operator Development Program

mapped address• In case of an IPv6 node communicatinggwith IPv4 node using mapped address, theremote address format will not be
xx.xx.xx.xx, and failure might happen.

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 161

IPv6 Operator Development Program

FQDN• Some applications
ppsuch as Apachepdecideaccess permission/rejection based on
source node domain name.
name However,
However client
reverse lookup may not be configured inmany cases in IPv6,
IPv6 so you have to becareful when enabling IPv6 on servers
currently
l iin operation.
i© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 162

IPv6 Operator Development Program

Operation• DNS reverse lookupp• SMTP issues• Log
L fformatt• Address auto-configurationg• Troubleshooting (FQDN)• VLAN© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 163

IPv6 Operator Development Program

DNS reverse lookup• Consideringg the client addresses will beaccessed using privacy extensions, ACL
using DNS reverse lookup will not be ineffect.

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 164

IPv6 Operator Development Program• DNS reverse lookupp• SMTP issues• Log
L fformatt• Address auto-configurationg• Troubleshooting (FQDN)• VLAN© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 165

IPv6 Operator Development Program

SMTP issues• There are wrong
g implementationsp
that
TCP fallback may not occur properly whena server of MX RR has A RR and AAAA
RR. (very rare case.)© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 166

IPv6 Operator Development Program

SMTP issues• How to fix the problem$ORIGIN example.jp.
;
@
IN
MX 10
;
mail
IN
A
IN
AAAA

mail
192.0.2.1
2001:db8::25

Change this to……
$ORIGIN example.jp.
;
@
IN
MX 10
MX 20
;
mail
IN
A
IN
AAAA
;
Mail4
IN
A

mail
mail4
192.0.2.1
2001:db8::25
192.0.2.1© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 167

IPv6 Operator Development Program• DNS reverse lookupp• SMTP issues• Log
L formatft• Address auto-configurationg• Troubleshooting (FQDN)• VLAN© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 168

IPv6 Operator Development ProgramLog format• There are no abbreviation rules in thesyslog output addresses. It depends on
the applications that outputs the logs
logs.
Therefore, address matching using grep
sometimes does not work
work. (This issue isurrently under discussion in IETF)© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 169

IPv6 Operator Development Program• DNS reverse lookupp• SMTP issues• Log
L fformatt• Address auto
auto--configurationg• Troubleshooting (FQDN)• VLAN© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 170

IPv6 Operator Development Program

Address auto-configuration• This was supposedpp
to decrease the work
load of operators who had to look overmultiple client nodes
nodes.
– However, you should not use autoconfigurations in servers because the address
might change when you change the NIC, etc• Filtering
Filt i rules
l hhave tto b
be changedhd withith address
ddchange© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 171

IPv6 Operator Development Program• DNS reverse lookupp• SMTP issues• Log
L fformatt• Address auto-configurationg• Troubleshooting (FQDN)• VLAN© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 172

IPv6 Operator Development Program

Trouble shooting (FQDN)• If a FQDN is registeredgin monitoringg tools,
make sure the tools are not be effected by
the IPv6/IPv4 fallbacks© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 173

IPv6 Operator Development Program

Operation• DNS reverse lookupp• SMTP issues• Log
L fformatt• Address auto-configurationg• Troubleshooting (FQDN)• VLAN© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 174

IPv6 Operator Development Program

VLAN• No major
j pproblem in p
port VLAN or tagged
gg
VLAN• MAC address based VLAN
– Probably not used in ISPs, but there are noffeasible
ibl iimplementationslt ti• When a RA is transmitted to multicast address, allusers will
ill receivei ththe address
dd• It is better not to use it© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 175

IPv6 Operator Development Program• Q&A?
Q© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 176

IPv6 Operator Development Program

Reference• How to be connected via IPv6?
• IPv6 terminologies© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 177

IPv6 Operator Development Program

How to be connected via IPv6?
• Purchase the IPv6 transit from the upstream
ISP
S– There are more than you expect• Contract with IPv6 ready iDC– There are more than you expect• Find a Tunnel
T nnel Broker– Feel6(dtcp)– OCN
OC IPv6(L2TP)
6( 2 )
http://ipv6.blog.ocn.ne.jp/ipv6/2006/04/linuxocn_ipv62_5915.
http://ipv6
blog ocn ne jp/ipv6/2006/04/linuxocn ipv62 5915
html
© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 178

IPv6 Operator Development Program

IPv6 terminologies• Node– IPv6 ready device• Router– A node that transfers IPv6 packets to others• Host– Any node other than routers© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 179

IPv6 Operator Development Program

IPv6 terminologies cont(2)• Upper layer– Upper protocol layer to IPv6 (TCP,UDP, etc)

• Link– Lower protocol layer to IPv6 (Ethernet, PPP, etc)

• Neighbors– Nodes connected on a same link

• Interface– Attachment of a node that is used to connect to a link

© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 180

IPv6 Operator Development Program

IPv6 terminologies cont(3)• Packet– Payload including IPv6 header (Data part)• Link MTU– Number of Maximum Transmission Unit on
the link• Path MTU– Minimum
Minim m link MTU among all the paths fromsource to destination node
© Task Force on IPv4 Address Exhaustion, Japan ALL RIGHT RESERVED. 181